Download to read offline
More Related Content
Similar to Running Regulated Workloads on Azure PaaS services (DogFoodCon 2018)
![[Toroman/Kranjac] Red Team vs. Blue Team in Microsoft Cloud](https://cdn.slidesharecdn.com/ss_thumbnails/fs0fswrr36f3q9puu3u6-signature-d4523b3bf020616e67040d2a940ba8bf9aeab187b20da49956548f98de22ea12-poli-180606121949-thumbnail.jpg?width=640&height=640&fit=bounds)
Running Regulated Workloads on Azure PaaS services (DogFoodCon 2018)
- 1. PaaS Solutions forRegulated Workloads DogFoodCon Jeremy Gray Microsoft Cloud Solution Architect, Financial Services 10/5/2018
- 2.
- 3. © Microsoft Corporation Contents ##Introduction ## Applicable Service Updates ## Overview ## Perimeter Security ## Identity and Access Management ## Vulnerability Management ## Logging and Monitoring ## Resource Governance
- 4. © Microsoft Corporation Leadingedge regulatory compliance capabilities empowering financial services Customers are moving! 90% of the "Too Big to Fail” financial institutions are now committed to the Microsoft Cloud… Institution is accountable & in control Regulator Right to Examine Over 100 financial services regulators engaged in last 4 years“The cloud is inevitable… But right now the timing isn’t right.” “Tell me how to get there in a safe & regulatory compliant way…” TODAY… FIVE YEARS AGO… Microsoft Confidential 4 Online Services (All Customers) Financial services Amendment (FS Only) Financial Services Compliance Program (FS Only)
- 5. © Microsoft Corporation USGovGlobalRegionalIndustry Azurecovers 72 compliance offerings Azure has the deepest and most comprehensive compliance coverage in the industry ISO 27001:2013 ISO 27017:2015 ISO 27018:2014 ISO 22301:2012 ISO 9001:2015 ISO 20000-1:2011 SOC 1 Type 2 SOC 2 Type 2 SOC 3 CSA STAR Certification CSA STAR Attestation CSA STAR Self-Assessment WCAG 2.0 (ISO 40500:2012) FedRAMP High FedRAMP Moderate EAR DoE 10 CFR Part 810 NIST SP 800-171 NIST CSF Section 508 VPATs FIPS 140-2 ITAR CJIS IRS 1075 PCI DSS Level 1 GLBA FFIEC Shared Assessments FISC (Japan) APRA (Australia) FCA (UK) MAS + ABS (Singapore) 23 NYCRR 500 HIPAA BAA HITRUST 21 CFR Part 11 (GxP) MARS-E NHS IG Toolkit (UK) NEN 7510:2011 (Netherlands) FERPA CDSA MPAA DPP (UK) FACT (UK) SOX Argentina PDPA Australia CCSL / IRAP Canada Privacy Laws China GB 18030:2005 China DJCP (MLPS) Level 3 Singapore MTCS Level 3 Spain ENS Spain DPA UK Cyber Essentials Plus UK G-Cloud UK PASF China TRUCS / CCCPPF EN 301 549 EU ENISA IAF EU Model Clauses EU – US Privacy Shield Germany C5 DFARS DoD DISA SRG Level 5 DoD DISA SRG Level 4 DoD DISA SRG Level 2 Germany IT-Grundschutz workbook India MeitY Japan CS Mark Gold Japan My Number Act Netherlands BIR 2012 New Zealand Gov CC Framework https://aka.ms/AzureCompliance
- 6.
- 7. © Microsoft Corporation Alloffers and claims are void No warranty expressed or implied Compliance is more than technical controls The Trust Center is your friend Disclaimer
- 8. © Microsoft Corporation Thisis why I think PaaS is a compelling option for regulated workloads, it contracts away your responsibility. Customer Responsibility Model IaaS PaaS SaaS App Configuration Azure Customer Azure Customer Azure Customer Application Azure Customer Azure Customer Azure Platform Azure Customer Azure Azure OS Azure Customer Azure Azure Network Azure Azure Azure
- 9. Risk management acrossservice models On-Prem IaaS PaaS SaaS Data classification and accountability Client & end-point protection Identity & access management Application level controls Network controls Host Infrastructure Physical Security Provider management of risk Physical | Networking Customer management of risk Data Classification and data accountability 9
- 10.
- 11. © Microsoft Corporation Azurechanges every week and some amazing updates have happened since the publishing of this blueprint. Services Updates Service Endpoints You can isolate ingress into the following PaaS services to a specific Azure vNet. • Azure Storage • Azure SQL Database • Azure Database for PostgreSQL • Azure Database for MySQL • Azure CosmosDB • Azure Key Vault • Azure SQL Data Warehouse • Azure Service Bus • Azure Event Hubs • Azure Monitor Product Updates • Global vNet peering • P2 JIT access • Azure Policy • Azure SQL Data retention • App Service vNet integration • Add more New Products • Azure Security Center • Compliance Manager • Azure DDos Protection • Managed Service Identity • AKS • Immutable Storage • Azure Firewall • Add more
- 12. © Microsoft Corporation Overview AzureKey Vault Azure Storage Operations Management Suite Microsoft Azure Azure Active Directory Azure Monitor Systems engineering Workload Identity, secrets & access management System health monitoring Storage Networking ExpressRoute VPN Gateway Suggested connection mechanisms to Azure Azure DNS Network security groups Web App Firewall Application Gateway Resource group Users CNAME record: custom domain to Application Gateway hostname Azure management portal Key Public Encrypted in Azure App Service Automation Application Insights Azure Runbooks TLS TLS Azure Security Center Load Balancer WebApp worker pools WebApp Azure SQL Database
- 13.
- 14. © Microsoft Corporation PerimeterSecurity - Applications Microsoft Azure Web App Firewall Application Gateway AzureFirewallSubnet Users TLS Resource group App Service Load Balancer Web App Function App subnet-ase-app Application Insights My Virtual network Azure SQL Azure Key Vault Blob StorageAzure Firewall Service Endpoint subnet-gateway User Defined Route (UDR) resource + region tag Service Endpoint Service Endpoint
- 15. © Microsoft Corporation PerimeterSecurity - Operations Systems engineering DevOps Administrator subnet-bastion Bastion Host VM Extensions 1. OMS Agent 2. Antimalware Microsoft Azure subnet-ase-app subnet-other-vm subnet-build-agents* Management Portal Command Line Interface
- 16. Just in Time Access Audit-ready JustEnough Access Privileged Admin Workflow Azure AD Privileged Identity Management
- 17.
- 18.
- 19. © Microsoft Corporation FeelBetter?
- 20. © Microsoft Corporation •Web Application Firewall • Hardened VM Images via Azure marketplace • Azure Security Center • Anti-malware extension • Intrusion Detection System (IDS) • File Integrity Monitoring (FIM) • Azure Monitor (formerly known as OMS) • Log Monitoring and Alerting Vulnerability Management
- 21. © Microsoft Corporation AzureSecurity Center
- 22. © Microsoft Corporation ConfigureData Collection
- 23. © Microsoft Corporation ConfigurePolicy – Policy Per Subscription
- 24. © Microsoft Corporation ConfigurePolicy – Management Groups
- 25.
- 26. Metrics Logs Application Container VMMonitoring Solutions Insights Dashboards Views Power BI Workbooks Visualize Metrics Explorer Log Analytics Analyze Alerts Autoscale Respond Event Hubs Ingest & Export APIs Logic Apps Integrate Azure Monitor Custom Sources Application Operating System Azure Resources Azure Subscription Azure Tenant Logging
- 27. Management Solutions –From Marketplace
- 28. Jump to ApplicationMap or VM Map Monitor health state of all resources Drill down into failures or perf issues See alerts firing across app & infra
- 29. Monitor ExpressRoute connectivity tovirtual networks and O365 Secure and audit your network with Network Watcher Traffic Analytics Monitor connectivity to LoB apps with Service Connectivity Monitor Discover and monitor ExpressRoute circuits, across subscriptions
- 30. Configure Pre- orPost-Deployment Quality Gates in Azure Pipelines Native IDE integrations in VS (.NET) and VS Code (Node.js) Run Load Test or Multi-Step Web Test for Synthetic Perf Monitoring Onboard with Azure Pipelines Release Management & DevOps Projects Continuous Monitoring for DevOps & IT Ops Work Item Management with Azure Boards for filing bugs and tracking Alerts & Notifications with automated actions & ITSM integrations
- 31. Integrate your existingAPM/Monitoring solutions with Azure Monitor Azure Monitor is best for Azure, and provides both APM & SIEM capabilities Route telemetry to your SIEM solutions for analytics & security management Open and extensible to continue using your favorite tools & solutions Integration with Monitoring & SIEM Tools
- 32. Integrate your existingAPM/Monitoring solutions with Azure Monitor Azure Monitor is best for Azure, and provides both APM & SIEM capabilities Route telemetry to your SIEM solutions for analytics & security management Open and extensible to continue using your favorite tools & solutions Integration with Monitoring & SIEM Tools
- 33. © Microsoft Corporation AzureCompliance Manager Launched through Service Trust Portal
- 34. © Copyright MicrosoftCorporation. All rights reserved.
- 35. Common Thread inSecurity Incidents SPEAR PHISHING EMAIL EXPLOIT KIT or INFECT USER MOVE ACROSS THE NETWORK INFECT THE DATA CENTER ADVERSARY COMMANDS STEAL DATA
- 36. Common Thread inSecurity Incidents on Public Clouds SPEAR PHISHING EMAIL EXPLOIT KIT or INFECT USER MOVE ACROSS INFRASTRUCTURE ADVERSARY COMMANDS STEAL DATA $ INCREASE COSTS EXPLOIT APPS & SERVICES ON CLOUD INFRASTRUCTURE HUMAN ERRORS DISRUPT APPS & SERVICES
Editor's Notes
- #2 https://www.linkedin.com/in/thejeremygray/
- #3 Rock my linked in https://www.linkedin.com/in/thejeremygray/
- #5 *“Too Big to Fail” meaning Globally Systemically Important Financial Institutions (G-SIFI) as defined by the Fiscal Stability Board. Note: excludes Chinese G-SIFIs. *”Committed to our Cloud” refers to those with online service terms in place and/or those that are actively deploying Just a short time ago most financial institutions were not prepared to even discuss moving to the Cloud. Microsoft formed a financial services Cloud Advisory Council with top global financial institutions and has held multiple regulatory summits around the world. Based on these learnings Microsoft developed special terms and a Compliance Program for financial institutions. This has led hundreds of financial institutions to go to the Cloud with Microsoft, including 27 out of the 34 (excludes China) Global Systemically Important Financial Institutions (GSIFI’s), otherwise known as “Too Big to Fail” – as of September 2016. More GSIFIs and financial institutions of all sizes are moving to the Cloud every month.
- #6 See https://aka.ms/AzureCompliance for more information. Jan-2018: Azure compliance coverage includes 72 offerings. Latest addition: APRA (Australia)
- #7 https://www.microsoft.com/en-us/trustcenter https://aka.ms/AzureCompliance https://aka.ms/azure-pci
- #8 I’m not an auditor, this foundational architecture was built for illustration and should be discussed with your internal compliance team and external auditors. You can put a 100% correct technology in place and not have the administrative, change management, vendor management, access control management, governance, human resources, and risk business functions in place and be WAY out of compliance. If you wanted to see if a specific product within azure fits within a specific industry or regional compliance offering…here is the link https://www.microsoft.com/en-us/trustcenter/compliance/complianceofferings
- #9 if you have control over a setting, you must answer for its compliance.
- #10 Customers of Microsoft Azure are ultimately responsible for their own compliance. The following describe the various responsibilities of Microsoft, their customers, or both to achieve compliance across SOC, ISO, NIST, PCI-DSS, etc.
- #11 https://docs.microsoft.com/en-us/azure/security/blueprints/pcidss-paaswa-overview
- #12 Note that Service Endpoints allow you to lock traffic, but they add other security issues for egress from the VNET. You need to also add Azure Firewall or an NVA with FQDN filtering to prevent data exfiltration
- #13 This is the visio directly from the service trust link https://servicetrust.microsoft.com/ViewPage/PCIBlueprint (Azure Security and Compliance Blueprint - PCI-DSS PaaS WebApp Overview) I’m going to break down a lot of these items in later slides, but I just wanted to show the overview.
- #15 Secure architecting for Azure: https://myignite.techcommunity.microsoft.com/sessions/66926 I need to add in App Service vNet integration (I just saw this in preview and I haven’t looked at all, has anyone used it or know what it looks like)
- #16 Talk about Azure AD P2 PIM for administrators Practical guide for using Azure Security Center to protect hybrid cloud environment: https://myignite.techcommunity.microsoft.com/sessions/65950 Azure Active Directory security insights with Conditional Access, Identity Protection, and reporting: https://myignite.techcommunity.microsoft.com/sessions/66656
- #17 16
- #21 Some references Anti-malware: https://docs.microsoft.com/en-us/azure/security/azure-security-antimalware | https://docs.microsoft.com/en-us/powershell/module/servicemanagement/azure/set-azurevmmicrosoftantimalwareextension?view=azuresmps-4.0.0 FIM: https://docs.microsoft.com/en-us/azure/security-center/security-center-file-integrity-monitoring IDS: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-intrusion-detection-open-source-tools | https://docs.microsoft.com/en-us/azure/security-center/security-center-detection-capabilities CIS Hardened images available in Azure Marketplace: https://azuremarketplace.microsoft.com/en-us/marketplace/apps?search=center%20for%20internet%20security&page=1&filters=partners%3Bpay-as-you-go
- #26 Monitoring your networks in Azure: https://myignite.techcommunity.microsoft.com/sessions/66293
- #27 https://azuremarketplace.microsoft.com/en-us/marketplace/apps/category/management-tools?page=1&subcategories=management-solutions https://azuremarketplace.microsoft.com/en-us/marketplace/apps/category/management-tools?page=1&subcategories=monitoring-diagnostics
- #28 I drew this, be kind
- #29 1. Activity Log Analytics (marketplace, see link) 2. Azure Networking Analytics (https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-azure-networking-analytics) 3. Azure SQL Analytics (https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-sql-assessment?toc=/azure/monitoring/toc.json) 4. Change Tracking (marketplace, see link) 5. Key Vault Analytics (marketplace, see link) 6. Service Map (https://docs.microsoft.com/en-us/azure/monitoring/monitoring-service-map) https://azuremarketplace.microsoft.com/en-us/marketplace/apps/category/management-tools?page=1&subcategories=management-solutions
- #32 Build the right solution for your business by Continuous DevOps Monitoring and Learning https://myignite.techcommunity.microsoft.com/sessions/66593
- #33 Everything about Azure Monitor telemetry and building integration with ITSM/SIEM tools https://myignite.techcommunity.microsoft.com/sessions/66187
- #34 Everything about Azure Monitor telemetry and building integration with ITSM/SIEM tools https://myignite.techcommunity.microsoft.com/sessions/66187
- #35 https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Announcing-Compliance-Manager-general-availability/ba-p/161922